NASA’s Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 contains a flaw that allows an attacker to inject arbitrary SQL code through the category parameter. This weakness permits unauthorized manipulation or extraction of data stored in the database, potentially revealing sensitive information or allowing tampering with records.

The affected product is NASA Earth Observing System Data and Information System (EOSDIS) MODAPS, version 8.1. No other vendors or versions are identified.

The CVSS score of 9.4 indicates a high severity, the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The presence of a direct SQL injection path through a user‑controllable parameter suggests that an attacker who can send crafted requests to the application could trigger the flaw. Successful exploitation would expose or alter data within the MODAPS database, and if the database contains privileged information, the impact could be significant. The attack vector is inferred to be external, via HTTP requests to the web interface that processes the category parameter.